Method and apparatus for supporting multiple broadcasters independently using a single conditional access system

ABSTRACT

A method and apparatus for brokering the enablement of the communication of encrypted media programs from a plurality of independent broadcasters to a plurality of receivers is disclosed. The system makes use of a pairing key for each provided service, which is differently encrypted by a pairing server and by the broadcaster providing the service. The encrypted versions of the pairing key are decrypted in a first receiver module using information known to the pairing service but not the broadcaster and in a second receiver module using information known to the broadcaster. The pairing key is used to cryptographically bind the first and second receiver modules.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.13/541,492, entitled “METHOD AND APPARATUS FOR SUPPORTING MULTIPLEBROADCASTERS INDEPENDENTLY USING A SINGLE CONDITIONAL ACCESS SYSTEM,” byRonald P. Cocchi, Gregory J. Gagnon, and Dennis R. Flaharty, filed Jul.3, 2012, now issued as U.S. Pat. No. 9,014,375, which application is acontinuation of U.S. patent application Ser. No. 11/795,272, entitled“METHOD AND APPARATUS FOR SUPPORTING MULTIPLE BROADCASTERS INDEPENDENTLYUSING A SINGLE CONDITIONAL ACCESS SYSTEM,” by Ronald P. Cocchi, GregoryJ. Gagnon, and Dennis R. Flaharty, filed Jul. 13, 2007, now issued asU.S. Pat. No. 8,243,925, which is a national phase application ofInternational Patent Application No.: PCT/US2005/037197, entitled“METHOD AND APPARATUS FOR SUPPORTING MULTIPLE BROADCASTERS INDEPENDENTLYUSING A SINGLE CONDITIONAL ACCESS SYSTEM,” by Ronald P. Cocchi, GregoryJ. Gagnon, and Dennis R. Flaharty, filed Oct. 18, 2005, which claimsbenefit of U.S. Provisional Patent Application No. 60/619,663, entitled“METHOD OF SUPPORTING MULTIPLE BROADCASTERS INDEPENDENTLY USING A SINGLECONDITIONAL ACCESS SYSTEM,” by Ronald P. Cocchi, Gregory J. Gagnon, andDennis R. Flaharty, filed Oct. 18, 2004, all of which applications arehereby incorporated by reference herein.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to systems and methods for providingconditional access to media programs, and in particular to a system andmethod for providing for such conditional access between multipleindependent broadcasters and a plurality of customers using a singleconditional access system.

2. Description of the Related Art

For many years, media programs such as television and radio programshave been broadcast to viewers/listeners free of charge. More recently,this free-of-charge dissemination model has been augmented with afee-for-service and/or fee-for-view model in which paying subscribersare provided access to a greater variety and number of media programs,including video programs, audio programs and the like, by cable,satellite and terrestrial broadcasts.

However, while subscriber-based services are readily available in someareas, they are not available on a world-wide basis. Further, in currentmedia program subscription business models, subscribers are typicallyoffered services from a small number of providers (e.g. DIRECTV orECHOSTAR, or the approved local cable provider) each of which typicallyprovide a large number of media channels from a variety of sources (e.g.ESPN, HBO, COURT TV, HISTORY CHANNEL). To assure that only subscribersreceive the media programs, each service provider typically encrypts theprogram material and provides equipment necessary for the customer todecrypt them so that they can be viewed.

Since they provide a large number of programs and typically at arelatively high cost, the vast majority of customers subscribe to onlyone of the foregoing services (e.g. DIRECTV, ECHOSTAR, or the localcable provider), but not multiple providers. It is expected that futurebusiness models will evolve to the point where customers will subscribeto more than one media provider, each of which provides a smaller numberof media channels. The foregoing is especially true in areas wheresubscriber-based services are in their infancy, including for example,large parts of Asia, Africa, and South America.

One of the roadblocks to the evolution of such services is the means bywhich the service provider assures that only paying customers receivetheir media programs. Existing conditional access systems are notcompatible with each other, and it is thought to be prohibitivelyexpensive for each provider of a limited number of media programs toproduce and provide its own conditional access system to potentialsubscribers. Another problem is that customers would typically prefer toreceive all media programs through a single device (and hence, a singleconditional access system), rather than multiple such systems.Accordingly, there is a need in the art for a method and apparatus thatallows multiple program providers (e.g. broadcasters) to transmit mediaprograms to paying subscribers via a single conditional access system.The present invention satisfies that need.

SUMMARY OF THE INVENTION

To address the requirements described above, the present inventiondiscloses a method, apparatus, article of manufacture for brokering theenabling of communication of encrypted media programs from a pluralityof independent broadcasters to a plurality of receivers, each encryptedmedia program decryptable by a first receiver module securelycommunicating with a second receiver module according to a pairing keyassociated with one of the plurality of receivers. In one disclosedembodiment, the method comprises the steps of transmitting a serviceenabling request from one of the plurality of broadcasters to a brokerindependent from the one of the plurality of broadcasters, the requestcomprising an identification of the one of the plurality of receivers;receiving a first encrypted version of the pairing key E_(S) ₁ [K_(p)]from the broker, the first encrypted version of the pairing key E_(S) ₁[K_(p)] decryptable by first information S₁ securely stored in the firstreceiver module of the one of the plurality of receivers; generating asecond encrypted version of the pairing key K_(p), the second encryptedversion of the pairing key E_(S) ₂ [K_(p)] decryptable by secondinformation S₂ securely stored in the second receiver module; andtransmitting the first encrypted version of the pairing key E_(S) ₁[K_(p)] and the second encrypted version of the pairing key E_(S) ₂[K_(p)] to the one of the plurality of receivers. In another disclosedembodiment, the apparatus is described by system for brokering theenabling of communication of encrypted media programs from a pluralityof independent broadcasters to a plurality of receivers, each encryptedmedia program decryptable by a first receiver module securelycommunicating with a second receiver module according to a pairing keyK_(p) associated with one of the plurality of receivers. The systemcomprises a broker, for providing a first encrypted version of thepairing key E_(S) ₁ [K_(p)] in response to a service enabling requestfrom one of the plurality of broadcasters, the service request having anidentification of one of the plurality of receivers, wherein the firstencrypted version of the pairing key E_(S) ₁ [K_(p)] is decryptable byfirst information S₁ stored in the first receiver module.

BRIEF DESCRIPTION OF THE DRAWINGS

Referring now to the drawings in which like reference numbers representcorresponding parts throughout:

FIG. 1 is a diagram illustrating a media program distribution system;

FIG. 2 is a diagram of a typical subscriber station;

FIG. 3 is a diagram illustrating a multiple broadcaster media programdistribution system;

FIGS. 4A-4D are diagrams illustrating one embodiment of how the pairingsystem cooperatively operates with multiple service providers andequipment at the subscriber stations to implement a conditional accesssystem;

FIG. 5A is a diagram illustrating one embodiment of the serviceprovider;

FIG. 5B is a diagram illustrating an embodiment of a table stored in thepairing system;

FIG. 5C is a diagram illustrating an embodiment of a table stored by theservice provider;

FIG. 6 is a diagram illustrating one embodiment of the STB; and

FIG. 7 is a diagram of a computer that can be used to implement selectedmodules.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

In the following description, reference is made to the accompanyingdrawings which form a part hereof, and which is shown, by way ofillustration, several embodiments of the present invention. It isunderstood that other embodiments may be utilized and structural changesmay be made without departing from the scope of the present invention.

FIG. 1 is a diagram illustrating a media program distribution system100. The system 100 includes a plurality of service providers(hereinafter alternatively referred to as broadcasters) 102, including afirst service provider 102A that broadcasts media programs from asatellite broadcast facility 152A via one or more uplink antennas andone or more satellites 156, a second service provider 102B, thatbroadcasts media programs from terrestrial broadcast facility 152B andone or more terrestrial antennas 164, and a third service provider 102Cthat broadcasts media programs via a cable link 160.

The system 100 also comprises a plurality of subscriber stations 104A,104B (alternatively referred to hereinafter as subscriber station 104),each providing service to one or more subscribers 112A, 112B(alternatively referred to hereinafter as subscribers 112). Eachsubscriber station 104A, 104B may include a satellite reception antenna106A, 106B (alternatively referred to hereinafter as satellite receptionantenna 104) and/or a terrestrial broadcast antenna 108A, 108B(alternatively referred to hereinafter as terrestrial broadcast antenna108) communicatively coupled to a receiver 110A, 110B (alternativelyreferred to hereinafter as receiver 110), which is also known as a settop box (STB) or an integrated receiver/decoder (IRD).As described above, in prior art systems, each receiver 110A, 110B (orat least, each conditional access system used with each receiver) iscapable of receiving subscriber-based media programs from only one ofthe media program providers 102. Hence, if a subscriber 112 wanted toreceive media programs from more than one media program provider 102 ona subscription basis, the subscriber may need not only to have amultiple receivers 110 at the subscriber station 104A, but also, willrequire multiple conditional access systems.

FIG. 2 is a diagram of a typical subscriber station 104. Each station104 includes at least one receiver or STB 110, which itself includes atransport module 202 that communicates with a conditional access module(CAM) 206. In one embodiment, the CAM 206 is a smart card that isremovably communicatively coupleable to the transport module 202 andhence, the STB 110. In another embodiment, the CAM 206 is a device suchas a chip or a collection of devices that are physically integrated withthe STB 110 and irremovable. To assure that only those who subscribe tothe service are provided with media programs, the service providerstypically encrypt the media program M with a control word CW, thusproducing and encrypted program E_(CW)[M], and transmit the encryptedmedia program E_(CW)[M] and an encrypted version of the control wordE[CW] to the receiver 110. The receiver 110 receives both the encryptedprogram E_(CW)[M] and the encrypted control word E[CW]. The transportmodule 202 analyzes the incoming data stream and passes the encryptedcontrol E[CW] to the CAM 206, which decrypts the control word CW andreturns the decrypted control word CW to a security module 204 orsimilar device in the transport module 202. The security module 204 thenuses the control word CW to decrypt the encrypted media programE_(CW)[M] to produce the media program M for presentation to thesubscriber. This system assures that only those who are in possession ofa valid CAM 206 can receive and decode media programs. However, it doesnot prevent the use of the CAM 206 in any other STB 110. Hence, if theCAM 206 is compromised or duplicated, unauthorized access to mediaprograms is possible.

FIG. 3 is a diagram illustrating a multiple broadcaster ConditionalAccess Subscriber Administration System (CASAS) 200. The MB system 200is similar to that which is disclosed in FIG. 1, but includes a pairingbroker 304, which can communicate with the broadcast facilities 152 viaa communications medium 302 such as the Internet.

FIGS. 4A-4D are diagrams illustrating one embodiment of how the pairingbroker 304 cooperatively operates with multiple service providers 102and equipment at the subscriber stations 104 to implement a conditionalaccess system. FIGS. 4A-4D will be described in connection with and withreference to FIGS. 5 and 6, which illustrate one embodiment of theservice provider 102 elements and STB 110 elements, respectively.

FIG. 4A begins with a potential customer 112 who has decided tosubscribe a media program service offered by a service provider 102. Todo so, the subscriber contacts the service provider 102 and transmitsinformation sufficient to identify the STB and the CAM to the serviceprovider 102, as shown in block 402. In one embodiment, this informationincludes an STB 110 unique identifier (ID) (such as a serial number orother designation) and a CAM 206 unique identifier (CAM ID). In apreferred embodiment, this is accomplished by transmitting theinformation via the Internet 302 or similar network.

This can be accomplished by use of a web browser implemented in acomputer 512 disposed at the subscriber station 104 and a webtransaction module 502 implemented at the service provider 102. Ifdesired, the subscriber's web browser can include the appropriatereferences to the URL where the request and STB ID and CAM ID should betransmitted. In one embodiment, in addition to the STB ID, the potentialsubscriber also transmits his/her credit card information (e.g. theaccount number) as well. This allows for services to be automaticallybilled for monthly subscription fees without further interaction. Creditcard payment administration can be performed by the service provider 102or by a third party such as PAYPAL. These functions can be performed bythe subscriber administration module (SAM) 504. The SAM 504 can alsocomprise or be integrated with a customer relationship management (CRM)system or systems. If access is approved (e.g. if the supplied creditcard information has been verified), the subscriber administrationmodule 504 directs the web transaction module 502 to request a pairingkey K_(p) from the pairing broker 304.

This implementation reduces the support requirements for the serviceprovider 102. In other embodiments, the potential customer 112 cancontact the service provider 102 via telephone or other means andprovide the service request, STB ID, and CAM ID. Further, if desired,the pairing broker 304 can receive the service request (preferably viaan appropriate Internet interface) and forward the request for serviceand the appropriate identifying information to the service provider 102.

The service provider 102 receives the service request the identifyinginformation, as shown in block 404. The service provider 102 thentransmits an enabling service request and the STB ID to the pairingbroker 304, as shown in block 408. In block 410, the pairing broker 304receives the service enabling request and the STB ID. A first encryptedversion of a pairing key K_(p) is then provided. The pairing key K_(p)was generated either in block by the service provider 102, as shown inblock 406 or, preferably by the pairing broker 304, as shown in block406′. The first encrypted version of the pairing key K_(p) is providedso as to be decryptable using first information S₁ securely stored in afirst receiver module such as the transport module 202 shown in FIG. 6(the first encrypted version of the pairing key K_(p) thereforedescribed as E_(S) ₁ [K_(p)]). In one embodiment, this is accomplishedby use of a secret that is known to the pairing broker 304, but unknownto the service provider 102. The STB IDs and related first informationS₁ can be stored in a table or a database 514 in the pairing broker 304.If desired, the related first encrypted versions of the pairing keyE_(S) ₁ [K_(p)] can be stored as well.

In block 414, the first encrypted version of the pairing key E_(S) ₁[K_(p)] is transmitted to the service provider 102. If the pairing keyK_(p) was generated by the pairing broker 304, the pairing key K_(p) isalso transmitted to the service provider 102. One of both of the firstencrypted version of the pairing key E_(S) ₁ [K_(p)] and the pairing keyK_(p) can be securely transmitted to the service provider 102 via ashared secret, a private key, or a public/private key security paradigm,if desired.

The foregoing process can be used to request all services from a serviceprovider with a single pairing key K_(p) or repeated to request otherservices from the service provider 102, with each service enabled andcontrolled via a different pairing key K_(p). For example, the serviceprovider 102 may provide both general services (e.g. access to a numberof channels as a part of a baseline fee service) and pay-per-viewservices (e.g. access to a particular program or set of programs on apay-per-view basis). Therefore, if the foregoing process was undertakento subscribe to the general services and the potential subscriber 112desires order ahead pay per view (OPPV) services or impulse pay per view(IPPV) services as well, the foregoing process can be repeated for thoseservices, resulting in the provision of a first encrypted version of adifferent pairing key for each service. The system 200 has the abilityto store credit information in the security module 204, CAM 206, orelsewhere, and can therefore limit the amount of IPPV events thesubscriber can purchase prior to requesting additional credits. Finally,the potential subscriber 112 can repeat this process for each serviceprovider 102 from which they wish to receive service.

Although the pairing broker 304 need not generate or store the pairingkeys K_(p), it may be desirable to do so. FIG. 5B is a diagram showing atable that might be used to store and relate the STB ID to firstinformation S₁, a service provider 102 identifier (BDCST ID), andpairing keys for general services, IPPV, and multiple OPPV services.

In block 420, the service provider 102 receives the first encryptedversion of the pairing key K_(p), and generates a second encryptedversion of the pairing key K_(p) such that it is decryptable by secondinformation S₂ securely stored in a second receiver module such as theconditional access module 206 (the second encrypted version of thepairing key K_(p) therefore described as E_(S) ₂ [K_(p)]).

The service provider 102 can store a table or database relating STB IDsand the pairing keys K_(p) for each of the provided services. FIG. 5C isan example of how such information may be stored. Note that the BRDCSTID column is not necessary in this case, because the identity of theservice provider 102 is inherently known.

In block 422, the service provider 102 transmits an entitlement controlmessage (ECM) or an entitlement management message (EMM) to thesubscriber station. The ECM is transmitted to the STB 110 in response toa subscriber request for access to general media programs from theservice provider 102, while the EMM is transmitted in response to asubscriber request for a specific program (e.g. an impulse or orderahead pay-per-view). The ECM/EMM includes the first encrypted version ofthe applicable pairing key E_(S) ₁ [K_(p)], the second encrypted versionof the pairing key E_(S) ₂ [K_(p)], and the ID of the service provider102 (BRDCST ID) which is providing the services related to the pairingkey K_(p). This transmission can be accomplished via the same systemused to transmit the media program M itself, or a differentcommunication system such as the Internet or a public switched telephonenetwork (PSTN) or cellphone network. In block 424, the transport module304 receives the first encrypted version of the pairing key E_(S) ₁[K_(p)] and the second encrypted version of the pairing key E_(S) ₂[K_(p)], and the service provider ID. The second encrypted version ofthe pairing key E_(S) ₂ [K_(p)] is provided to the conditional accessmodule 310, where it is received, decrypted (using the secondinformation S₂) to obtain the pairing key K_(p) which is stored (alongwith a reference to the service provider ID (BRDCST ID) from which thepairing key K_(p) was received), as shown in blocks 428 and 430.Similarly, the first encrypted version of the pairing key E_(S) ₁[K_(p)] is decrypted and stored in the transport module 304 (also alongwith a reference to the service provider ID from which the pairing keyK_(p) was received), as shown in block 432. FIG. 6 shows an exemplaryembodiment of how the data relating services, broadcasters, and pairingkeys K_(p) might be stored in the transport module and the conditionalaccess module.

Thereafter, the pairing key K_(p) is used to encrypt communicationsbetween the conditional access module 206 and the transport module 202.Henceforward, the conditional access module 206 cannot be used adifferent STB 110, although if desired, more than one STB 110 can beprovided to a customer, each having the same first information theconditional access module to be used with different STBs 110 in the samehousehold.

To begin service, the broadcast module 506 and/or the broadcast headend516 encrypts media programs M 510 according to a control word (CW),encrypts the control word (Cw) itself, and broadcasts a program streamcomprising the encrypted program material E_(CW)[M] and the encryptedcontrol word E[CW] to the STBs 100, as shown in blocks 450, 452 and 454.The program stream may also comprise program guide information from theprogram guide module 508.

The transport module 202 in the STB 110 receives the program stream,separates out the packets of information by channel (typically accordingto a packet ID), and provides the encrypted control word E[CW] to theconditional access module 206. The conditional access module 206receives the encrypted control word E[CW] decrypts it to recover thecontrol word (CW), encrypts the control word (CW) with the pairing keyK_(p), and provides the encrypted pairing key E_(K) _(p) [CW] to thetransport module 202, as shown in blocks 460-466. Using an STBapplication 602 and media kernel 604, the transport module 202 decryptsthe encrypted control word E_(K) _(p) [CW] using the pairing key K_(p)thus recovering the control word (CW), as shown in block 472, and usesthe decrypted control word (CW) to decrypt the encrypted media programE_(CW)[M] to produce the media program M, as shown in block 474.

The foregoing system can be used to modify or change the provision ofservices from the service provider 102 as well. This can be accomplishedby the service provider 102 deleting, adding, or modifying the pairingkeys K_(p) in cooperation with the pairing broker 304 in essentially thesame way as described above. Such modification can occur at thesubscriber's behest (e.g. the subscriber desires either more, less, ordifferent services than previously), or that of the service provider 102(e.g. if the offered services change or the subscriber's credit card isno longer valid).

The modules described above can be implemented as one or more softwaremodules comprising instructions being performed by one or more specialor general purpose processors, or may be implemented with hardwaremodules having dedicated circuitry, or with both hardware and softwaremodules. In one embodiment, for example, the pairing broker 304 isimplemented by a pairing server, and the program guide module 508,broadcast module 506, subscriber administration module 504 and webtransaction module 502 are all implemented as servers, the transportmodule 202 and security module 204 are implemented in a secure,tamperproof electronic circuit, and the conditional access module isimplemented on a smart card.

FIG. 7 illustrates an exemplary computer system 700 that could be usedto implement the servers or the subscriber computer 512 of the presentinvention. The computer 702 comprises a processor 704 and a memory, suchas random access memory (RAM) 706. The computer 702 is operativelycoupled to a display 722, which presents images such as windows to theuser on a graphical user interface 718B. The computer system 702 may becoupled to other devices, such as a keyboard 714, a mouse device 716, aprinter, etc. Of course, those skilled in the art will recognize thatany combination of the above components, or any number of differentcomponents, peripherals, and other devices, may be used with thecomputer 702.

Generally, the computer 702 operates under control of an operatingsystem 708 stored in the memory 706, and interfaces with the user toaccept inputs and commands and to present results through a graphicaluser interface (GUI) module 718A. Although the GUI module 718A isdepicted as a separate module, the instructions performing the GUIfunctions can be resident or distributed in the operating system 708,the computer program 710, or implemented with special purpose memory andprocessors. The computer 702 also implements a compiler 712 which allowsan application program 710 written in a programming language such asCOBOL, C++, FORTRAN, or other language to be translated into processor704 readable code. After completion, the application 710 accesses andmanipulates data stored in the memory 706 of the computer 702 using therelationships and logic that was generated using the compiler 712. Thecomputer 702 also optionally comprises an external communication devicesuch as a modem, satellite link, Ethernet card, or other device forcommunicating with other computers.

In one embodiment, instructions implementing the operating system 108,the computer program 710, and the compiler 712 are tangibly embodied ina computer-readable medium, e.g., data storage device 720, which couldinclude one or more fixed or removable data storage devices, such as azip drive, floppy disc drive 724, hard drive, CD-ROM drive, tape drive,etc. Further, the operating system 708 and the computer program 710 arecomprised of instructions which, when read and executed by the computer702, causes the computer 702 to perform the steps necessary to implementand/or use the present invention. Computer program 710 and/or operatinginstructions may also be tangibly embodied in memory 706 and/or datacommunications devices 730, thereby making a computer program product orarticle of manufacture according to the invention. As such, the terms“article of manufacture,” “program storage device” and “computer programproduct” as used herein are intended to encompass a computer programaccessible from any computer readable device or media.

Those skilled in the art will recognize many modifications may be madeto this configuration without departing from the scope of the presentinvention. For example, those skilled in the art will recognize that anycombination of the above components, or any number of differentcomponents, peripherals, and other devices, may be used with the presentinvention.

CONCLUSION

This concludes the description of the preferred embodiments of thepresent invention. The foregoing description of the preferred embodimentof the invention has been presented for the purposes of illustration anddescription. It is not intended to be exhaustive or to limit theinvention to the precise form disclosed. Many modifications andvariations are possible in light of the above teaching. It is intendedthat the scope of the invention be limited not by this detaileddescription, but rather by the claims appended hereto. The abovespecification, examples and data provide a complete description of themanufacture and use of the composition of the invention. Since manyembodiments of the invention can be made without departing from thespirit and scope of the invention, the invention resides in the claimshereinafter appended.

What is claimed is:
 1. A method of brokering an enabling ofcommunication of at least one encrypted media service of a group ofencrypted media services from a plurality of broadcasters to a pluralityof receivers, the at least one encrypted media service decryptable by afirst receiver module securely communicating with a second receivermodule according to a pairing key associated with a receiver of theplurality of receivers, comprising: transmitting a first media serviceenabling request for a first media service from a broadcaster of theplurality of broadcasters to a broker independent from the broadcaster,the first media service enabling request comprising an identification ofthe receiver; receiving a first encrypted version of the pairing keyE_(S) ₁ [K_(p)] in the broadcaster from the broker, the first encryptedversion of the pairing key E_(S) ₁ [K_(p)] decryptable by firstinformation S₁ securely stored in the first receiver module of thereceiver; encrypting the pairing key with second information S₂ togenerate a second encrypted version of the pairing key E_(S) ₂ [K_(p)]in the broadcaster, the second encrypted version of the pairing keyE_(S) ₂ [K_(p)] decryptable by the second information S₂ securely storedin the second receiver module; and transmitting the first encryptedversion of the pairing key E_(S) ₁ [K_(p)] and the second encryptedversion of the pairing key E_(S) ₂ [K_(p)] to the receiver; wherein eachmedia service in the group is enabled by a different pairing key K_(p).2. The method of claim 1, wherein the first media service is selectedfrom a group consisting of: a general broadcast service from thebroadcaster, including access to a number of media channels as abaseline fee service; a particular media program from the broadcaster;and a particular set of media programs from the broadcaster.
 3. Themethod of claim 2, wherein the media service is encrypted according to acontrol word CW, and the method further comprising: decrypting the firstencrypted version of the pairing key E_(S) ₁ [K_(p)] in the firstreceiver module; decrypting the second encrypted version of the pairingkey E_(S) ₂ [K_(p)] in the second receiver module; decrypting anencrypted version of the control word E[CW] in the second receivermodule; re-encrypting the decrypted control word CW according to thedecrypted second encrypted version of the pairing key; providing there-encrypted control word E_(K) _(p) [CW] from the second receivermodule to the first receiver module; and decrypting the re-encryptedcontrol word E_(K) _(p) [CW] using the decrypted first encrypted versionof the pairing key K_(p).
 4. The method of claim 1, further comprisingthe steps of: transmitting a second media service enabling request for asecond media service from the broadcasters to the broker, the secondmedia service enabling request comprising an identification of thereceiver; receiving a first encrypted version of a second pairing keyE_(S) ₁ [K_(p) ₂ ] from the broker, the first encrypted version of thesecond pairing key E_(S) ₁ [K_(p) ₂ ] decryptable by the firstinformation S₁ securely stored in the first receiver module of thereceiver; generating a second encrypted version of the second pairingkey E_(S) ₂ [K_(p) ₂ ], the second encrypted version of the pairing keyE_(S) ₂ [K_(p) ₂ ] decryptable by the second information S₂ securelystored in the second receiver module; and transmitting the firstencrypted version of the second pairing key E_(S) ₁ [K_(p) ₂ ] and thesecond encrypted version of the second pairing key E_(S) ₂ [K_(p) ₂ ] tothe receiver; wherein the second media service is different than thefirst media service.
 5. The method of claim 4, wherein the media programis encrypted according to a control word CW and the method furthercomprises the steps of: decrypting the first encrypted version of thesecond pairing key E_(S) ₁ [K_(p) ₂ ] in the first receiver module;decrypting the second encrypted version of the second pairing key E_(S)₂ [K_(p) ₂ ] in the second receiver module; decrypting an encryptedversion of the control word E[CW] in the second receiver module;re-encrypting the decrypted control word CW according to the decryptedsecond encrypted version of the second pairing key K_(p) ₂ ; providingthe re-encrypted control word E_(K_(P 2))[CW]  from the second receivermodule to the first receiver module; and decrypting the re-encryptedcontrol word E_(K_(P 2))[CW]  using the decrypted first encryptedversion of the second pairing key K_(p) ₂ .
 6. The method of claim 2,further comprising the steps of: transmitting a second media serviceenabling request for a second service from a second broadcaster of theplurality of broadcasters to the broker, the request comprising theidentification of the receiver; receiving a first encrypted version of asecond pairing key E_(S) ₁ [K_(p) ₂ ] from the broker, the firstencrypted version of the second pairing key E_(S) ₁ [K_(p) ₂ ]decryptable by the first information S₁ securely stored in the firstreceiver module of the receiver; generating a second encrypted versionof the second pairing key E_(S) ₂ [K_(p) ₂ ], the second encryptedversion of the pairing key E_(S) ₂ [K_(p) ₂ ] decryptable by the secondinformation S₂ securely stored in the second receiver module; andtransmitting the first encrypted version of the second pairing key E_(S)₁ [K_(p) ₂ ] and the second encrypted version of the second pairing keyE_(S) ₂ [K_(p) ₂ ] to the receiver; wherein the second media service isselected from the group consisting of: a general broadcast service fromthe second broadcaster, including access to a number of media channelsas a baseline fee service; a particular media program from the secondbroadcaster, including an order ahead pay per view service and animpulse pay per view service; and a particular set of media programsfrom the second broadcaster.
 7. The method of claim 6, wherein the mediaservice is encrypted according to a CW, and the method further comprisesthe steps of: decrypting the first encrypted version of the secondpairing key E_(S) ₁ [K_(p) ₂ ] in the first receiver module; decryptingthe second encrypted version of the second pairing key E_(S) ₂ [K_(p) ₂] in the second receiver module; decrypting the an encrypted version ofthe control word E[CW] in the second receiver module; re-encrypting thedecrypted control word CW according to the decrypted second encryptedversion of the second pairing key K_(p) ₂ ; providing the re-encryptedcontrol word E_(K_(P 2))[CW]  from the second receiver module to thefirst receiver module; and decrypting the re-encrypted control wordE_(K_(P 2))[CW]  using the decrypted first encrypted version of thesecond pairing key K_(p) ₂ .
 8. The method of claim 1, wherein the firstmedia service enabling request is transmitted in response to a mediaservice request, the media service request transmitted from the receiverto the broadcaster.
 9. The method of claim 1, wherein the firstinformation S₁ and the second information S₂ is known to the broker andthe broadcasters.
 10. The method of claim 1, wherein the firstinformation S₁ is known to the broker and unknown to the broadcaster,and wherein the second information S₂ is known to the broadcaster andunknown to the broker.
 11. The method of claim 1, wherein: the firstinformation S₁ is a first secret unique to the receiver and stored in afirst module of the receiver; the second information S₂ is a secondsecret is securely stored in a second module of the receiver.
 12. Themethod of claim 11, wherein the second module is a smart card removablycoupleable to the first module.
 13. The method of claim 11, wherein thesecond module is irremovably integrated with the receiver.
 14. Themethod of claim 1, wherein the pairing key is generated by thebroadcaster and transmitted to the broker.
 15. The method of claim 1,wherein the pairing key is generated by the broker and transmitted tothe broadcaster in response to the service enabling request.
 16. Asystem for brokering the enabling of communication of encrypted at leastone encrypted media service of a group of encrypted media services froma plurality of broadcasters to a plurality of receivers, the at leastone encrypted media service decryptable by a first receiver modulesecurely communicating with a second receiver module according to apairing key K_(p) associated with a receiver of the plurality ofreceivers, the system comprising: a broker, for providing a firstencrypted version of the pairing key E_(S) ₁ [K_(p)] in response to amedia service enabling request for a media service from a broadcaster ofthe plurality of broadcasters, the media service request having anidentification of the receiver; and wherein the first encrypted versionof the pairing key E_(S) ₁ [K_(p)] is decryptable by first informationS₁ stored in the first receiver module and wherein the first receivermodule receives the first encrypted version E_(S) ₁ [K_(p)] of thepairing key K_(p) and a second encrypted version of the pairing keyE_(S) ₂ [K_(p)] from the broadcaster, the second encrypted version ofthe pairing key E_(S) ₂ [K_(p)] being generated by the broadcaster byencrypting the pairing key with second information S₂ and beingdecryptable by second information S₂ stored in the second receivermodule; wherein each media service in the group is enabled by adifferent pairing key K_(p).
 17. The system of claim 16, wherein themedia service is selected from a group consisting of: a generalbroadcast service from the broadcaster, including access to a number ofmedia channels as a baseline fee service; a particular media programfrom the broadcaster; and a particular set of media programs from thebroadcaster.
 18. The system of claim 17, wherein the first informationS₁ and the second information S₂ is known to the broker and thebroadcaster.
 19. The system of claim 17, wherein the first informationS₁ is known to the broker and unknown to the broadcaster, and whereinthe second information S₂ is known to the broadcaster and unknown to thebroker.
 20. The system of claim 17, wherein: the first information S₁ isa first secret unique to the receiver and is securely stored in firstmodule of the receiver; and wherein the second information S₂ is asecond secret securely stored in second module of the receiver.
 21. Thesystem of claim 17, wherein the pairing key is generated by thebroadcaster and transmitted to the broker.
 22. The system of claim 17,wherein the pairing key is generated by the broker and transmitted tothe broadcaster in response to the media service enabling request. 23.An apparatus for brokering the enabling of communication of at least oneencrypted media service of a group of encrypted media services from aplurality of broadcasters to a plurality of receivers, the at least oneencrypted media service decryptable by a first receiver module securelycommunicating with a second receiver module according to a pairing keyassociated with a receiver of the plurality of receivers, comprising:means for transmitting a first media service enabling request for afirst media service from a broadcaster of the plurality of broadcastersto a broker independent from the broadcaster, the first media serviceenabling request comprising an identification of the receiver; means forreceiving a first encrypted version of the pairing key E_(S) ₁ [K_(p)]in the broadcaster from the broker, the first encrypted version of thepairing key E_(S) ₁ [K_(p)] decryptable by first information S₁ securelystored in the first receiver module of the receiver; means forencrypting the pairing key with second information S₂ to generate asecond encrypted version of the pairing key E_(S) ₂ [K_(p)] in thebroadcaster, the second encrypted version of the pairing key E_(S) ₂[K_(p)] decryptable by the second information S₂ securely stored in thesecond receiver module; and means for transmitting the first encryptedversion of the pairing key E_(S) ₁ [K_(p)] and the second encryptedversion of the pairing key E_(S) ₂ [K_(p)] to the receiver; wherein eachmedia service in the group is enabled by a different pairing key K_(p).24. The apparatus of claim 23, wherein the media service is selectedfrom a group consisting of: a general broadcast service from thebroadcasters, including access to a number of media channels as abaseline fee service; a particular media program from the broadcaster;and a particular set of media programs from the broadcaster.